Quantum Value at Risk (QVaR) 2026: $796.7B in Institutional Digital-Asset Exposure to Quantum Risk

Quantum Value at Risk (QVaR) is a framework for measuring post-quantum cryptographic financial exposure. It separates Asset QVaR, Flow QVaR and Settlement QVaR so institutions can distinguish standing value, transaction throughput and attack-window settlement exposure.

Traditional financial VaR estimates potential market loss over a defined time horizon and confidence level. QVaR is not statistical market VaR: it measures quantum-related cryptographic exposure and control effectiveness so institutions can compare control surfaces and prioritize post-quantum migration.

Quantum-Critical Exposure (QCE) is the standing dollar value governed by a quantum-vulnerable cryptographic control surface before the Current Vulnerability Factor and deployed mitigation are applied. Depending on the programme, QCE can be circulating supply, AUM, custody assets, network asset footprint or another clearly identified value base tied to cryptographic authority.

Asset QVaR uses A-QVaR = QCE × CVF × (1 − DME). Flow QVaR uses F-QVaRₕ = QCFₕ × CVF × (1 − DME), where QCF is quantum-critical flow over horizon h. Settlement QVaR additionally applies the effective attack/settlement window and institution-specific loss severity. Migration Readiness Score (MRS) is reported separately and does not reduce current QVaR merely because a roadmap exists.

$796.7 billion is the modeled gross, non-deduplicated Asset QVaR across the scored standing-exposure categories in the Q3 2026 register: stablecoins, tokenized funds, custody/MPC and public-chain exposure. It is a vulnerability-adjusted exposure measure, not a forecast that $796.7 billion will be lost in a quantum attack.

No. Gross Asset QVaR is intentionally non-deduplicated because the same underlying asset can depend on multiple independent cryptographic control surfaces. It measures modeled control-surface exposure, not unique assets or expected loss.

SIFMA reports $157.8 trillion of global equity market capitalization and $160.7 trillion of global fixed-income securities outstanding for 2025, or $318.5 trillion combined. QVaR uses this only as addressable capital-market context for institutional tokenization, not as current on-chain or quantum-exposed value.

Primary source: SIFMA 2026 Capital Markets Fact Book findings

No. The report explicitly does not claim the entire $318.5 trillion capital-market base is already on-chain or will be tokenized by a particular date. The point is that tokenization can progressively place larger portions of financial-market infrastructure under cryptographic controls.

Major stablecoins are not automatically end-to-end post-quantum safe because minting, burning, pausing, freezing, blacklisting, upgrades and treasury controls can depend on classical ECDSA or EdDSA authorization and on the security of the underlying chain. A stablecoin should only be described as end-to-end PQ-safe when every material control surface and dependency has verified post-quantum protection.

No. MPC and threshold signing can materially improve classical key-management resilience, but they do not change the post-quantum security of the underlying ECDSA signature primitive. A threshold ECDSA system remains dependent on elliptic-curve hardness unless a post-quantum authorization path is added.

Ethereum is not end-to-end post-quantum today. The Ethereum Foundation has a dedicated PQ team and a structured Lean Ethereum roadmap targeting core post-quantum infrastructure around 2029.

Primary source: Ethereum.org

Solana is not end-to-end post-quantum today. Protocol transactions use Ed25519; PDAs are off-curve and have no private keys. The Solana Foundation identifies the Winternitz Vault as a deployed quantum-resistant primitive and describes a broader migration path, but no protocol-wide PQ signature migration is live.

Primary source: Solana Foundation

Canton is not end-to-end post-quantum safe today. Canton reports $6T+ processed monthly and $350B+ daily tokenized U.S. Treasury repo activity; this report uses the explicitly time-bounded monthly throughput for Flow QVaR. Digital Asset states that ML-DSA signing is available behind an experimental flag and broader PQC migration is underway.

Primary source: Canton Network Forum / Digital Asset

Stock Hyperledger Besu is not an end-to-end post-quantum transaction, consensus, P2P and privacy stack. Existing Besu networks can add PQ privacy, tokenization and custody controls incrementally, while a greenfield PQ-safe ledger can extend protection into validator signing, P2P/node identity, native transaction authorization and privacy. The report maps these Besu control surfaces to EternaX remediation components.

Primary source: Hyperledger Besu QBFT documentation

Zcash is not end-to-end post-quantum today. Ironwood NU6.3 activated on mainnet July 28, 2026 and makes Ironwood-pool funds quantum-recoverable, but quantum recoverability is not the same as PQ-safe transaction authorization.

Primary source: Zcash NU6.3

Quantum-safe authorization aims to prevent a quantum adversary from forging or taking over current authorization. Quantum recoverability focuses on restoring or reclaiming control after a cryptographic failure event. A system can make progress on recoverability while current transaction signatures remain classically vulnerable.

No. NIST IR 8547 is an Initial Public Draft, not a universal private-sector law. Its proposed transition guidance distinguishes algorithm families and classical security strengths, so institutions should treat the 2030/2035 dates as important migration-planning signals rather than one blanket legal deadline for every blockchain programme.

Primary source: NIST IR 8547 Initial Public Draft

Executive Order 14412 requires specified U.S. Federal high-value assets and high-impact systems to use post-quantum cryptography for key establishment by December 31, 2030 and digital signatures by December 31, 2031. It also directs a separate FAR rulemaking process for covered contractors.

Primary source: Executive Order 14412

No. The FIPS 140-2 transition is a cryptographic-module validation transition, not itself a post-quantum migration deadline. FIPS 140-2 validations remain active through September 21, 2026, after which the active CMVP programme moves to FIPS 140-3 validations.

Primary source: NIST CMVP FAQ

An institution reduces current QVaR by deploying controls that actually reduce the vulnerable cryptographic surface: post-quantum transaction authorization, validator or consensus signing, verification, privacy, custody, identity/compliance and settlement controls. A roadmap improves Migration Readiness Score but does not reduce current QVaR until mitigation is deployed.

Sometimes. A PQ authorization or policy gate can be added around existing custody, tokenization or privacy workflows without replacing the underlying provider or chain. That protects the covered control surface but does not automatically remove quantum exposure in unchanged chain-level, validator-level or outer authorization dependencies.

The QVaR Verification Standard requires reproducible evidence rather than narrative claims: demonstrate a representative classical control surface in a controlled test, show what compromised classical authorization permits, deploy the corresponding PQ-protected control, replay the same action, and publish the code, configuration and verifiable transaction or protocol evidence.

The QVaR Register is designed as a quarterly research series. Each edition should refresh AUM, supply, custody, network and flow inputs; cryptographic architecture evidence; deployed mitigation; migration readiness; overlap treatment; confidence grades; and methodology changes.

Yes. A named institution can submit primary evidence that materially changes its architecture, exposure input, control-surface mapping, deployed mitigation or migration-readiness assessment. Accepted changes should be reflected in the next edition with a transparent methodology change log.

Grade A means primary evidence such as on-chain code, protocol specifications, regulatory filings, issuer attestations or official technical documentation. Grade B means official provider disclosure or high-quality secondary evidence where implementation is not independently inspectable. Grade C means estimated exposure, inferred architecture or market-share analysis and should carry explicit uncertainty.

Arc is not end-to-end post-quantum today. Circle states Arc already supports SLH-DSA for developers and wallets, while core transaction signatures remain ECDSA. Public mainnet is scheduled for September 16, 2026.

Primary source: Circle

In the supplied benchmark, Tempo scores 54 and receives 0/3 core PQ coverage today. No live PQ signature, PQ consensus or PQ-durable privacy layer is credited, and the authentication interface is not treated as full-stack migration.

In the supplied benchmark, Stellar scores 37 and receives 0/3 core PQ coverage today. Ed25519 accounts remain classical, no PQ consensus layer is credited, and public-by-default operation does not provide PQ confidentiality.

In the supplied benchmark, Starknet scores 61 but receives 0/3 full-layer PQ coverage. A Falcon-512 account demonstration is treated as experimental, and STARK proving is not treated as equivalent to end-to-end PQ-safe consensus, privacy and transaction authorization.

Sui is not end-to-end post-quantum today. Sui has built ML-DSA-65 native accounts and an SLH-DSA vault path; quantum-safe vaults are targeted for Mainnet in 2026 and native ML-DSA account authentication for Mainnet in Q1 2027.

Primary source: Sui

In the supplied benchmark, Aptos scores 56 and receives 0/3 live PQ core coverage. The SLH-DSA path is feature-gated rather than live mainnet authorization, and consensus/privacy are not credited as PQ-safe.

NEAR has live ML-DSA account/access-key signing. Consensus remains classical and NEAR targets post-quantum consensus by the end of 2027. The benchmark therefore gives NEAR partial 1/3 coverage.

Primary source: NEAR

Algorand has native Falcon-1024 accounts live on Mainnet since August 2026 and Falcon-based State Proofs, but consensus and VRF dependencies are not yet fully post-quantum. The benchmark therefore gives Algorand partial 1/3 coverage.

Primary source: Algorand

XRPL is not post-quantum today. Ripple is actively testing quantum-resistant cryptography and hybrid migration paths and targets full post-quantum readiness no later than 2028.

Primary source: Ripple

DTC currently custodies more than $114 trillion of assets. DTCC processed live production trades using DTC-tokenized assets with about 40 participating firms in July 2026 and plans to launch the DTC Tokenization Service in October 2026. The significance for QVaR is that tokenization is moving into core market infrastructure, increasing the value dependent on cryptographic control surfaces.

Primary source: DTCC

Broadridge reported that its Distributed Ledger Repo platform processed $351 billion in average daily repo transactions and $7.4 trillion of total volume in August 2026. DLR is a live institutional tokenized financing and collateral workflow within the Canton ecosystem and is therefore relevant evidence for Flow QVaR, but it is not added again to Canton Flow QVaR.

Primary source: Broadridge

BlackRock states that it has nearly $150 billion in AUM connected to digital assets, including the world's largest tokenized treasury fund, approximately $65 billion of stablecoin reserves and nearly $80 billion of digital-asset ETPs. The figure is institutional-adoption context, not a standalone QVaR calculation.

Primary source: BlackRock

Asset QVaR measures standing economic value governed by vulnerable cryptographic controls and is expressed in dollars at a point in time. Flow QVaR measures vulnerability-adjusted quantum-critical transaction throughput over a defined period such as dollars per day, quarter or month. Because their units differ, Asset QVaR and Flow QVaR must not be added together.

Canton explicitly publishes a $6T+ processed-monthly metric, so this report uses that time-bounded figure as transaction throughput for Flow QVaR rather than silently treating it as unique assets outstanding. Canton also uses $6T+ tokenized-RWA language elsewhere, which is why the report keeps the flow and stock interpretations separate unless the underlying asset-inventory definition is independently reconciled.

A migration roadmap does not change the cryptographic primitive protecting transactions today. MRS therefore measures preparedness and future risk trajectory, while only Deployed Mitigation Effectiveness (DME) can reduce current Asset or Flow QVaR in the model.

Settlement QVaR estimates the value that can become economically exposed during a defined compromise-to-detection-to-containment and settlement window. It requires institution-specific data such as transaction limits, compromised key/control scope, finality, DvP or netting, reversibility, monitoring, detection and containment time, recovery mechanisms and loss severity.